Principal Medical Device Product Security Engineer

6942-ABIOMED Inc. Legal Entity; Danvers (MA); Hybrid; USD 102,000 - 177,000; Full time

Benefits offered by this job

Vacation –120 hours per calendar year

Sick time – 40 hours per calendar year

13 holidays per calendar year

Parental Leave – 480 hours

Job summary

Johnson & Johnson’s MedTech cybersecurity team is seeking a Principal Product Security Engineer to be located in Danvers, MA. Remote work options may be considered; travel up to 10-20% is anticipated.

Lead the Product Security process for Heart Recovery devices, delivering security architecture, cryptographic controls, and threat mitigation across the product lifecycle. You will join Abiomed, part of Johnson & Johnson MedTech, and provide strategic leadership in securing heart pump technologies,

Qualifications

• 10+ years industry experience in Information Security.
• 8+ years experience with embedded system, IoT, or medical device cybersecurity.
• Bachelor’s degree or equivalent.
• Experience generating Threat models without the use of threat modeling tools.
• Experience performing risk assessments utilizing CVSS 3.1 or higher, with STRIDE per element.
• Ability to write technical security requirements for embedded systems and web platforms based on the latest regulations.
• Understanding of third-party penetration testing, vulnerability scanning, CVSS and other security testing principles.
• Experience supporting regulatory security submissions, ensuring compliance with FDA Cybersecurity Guidance, EU MDR, NIST 800-53, IMDRF, and AAMI TIR57.
• Knowledge of real-time operating systems hardening techniques.
• Knowledge of cloud security principles.

Responsibilities

• Define and implement secure boot, firmware integrity validation, and anti-tamper mechanisms.
• Enforce cryptographic protocols for data-at-rest and data-in-transit per regulatory standards.
• Define and implement key management infrastructure (PKI, HSMs, TPMs, secure enclave).
• Develop real-time vulnerability assessment techniques for wireless communications in devices.
• Implement Zero Trust security for device-to-cloud connectivity.
• Oversee secure OTA update mechanisms and code signing.
• Lead Secure Development Lifecycle practices within Heart Recovery products.
• Work with R&D to define hardware security architecture and trusted zones.
• Respond to customer cybersecurity questionnaires and contractual language as needed.

Skills

Information security

Embedded systems security

Security requirements

Threat modelling

Education

Bachelor’s degree or equivalent

Tools

QNX QOS

Yocto

Linux (Ubuntu)

Alpine

Job description

Johnson & Johnson’s MedTech cybersecurity team is seeking a Principal Product Security Engineer to be located in Danvers, MA. Remote work options may be considered; travel up to 10-20% is anticipated.

Lead the Product Security process for Heart Recovery devices, delivering security architecture, cryptographic controls, and threat mitigation across the product lifecycle. You will join Abiomed, part of Johnson & Johnson MedTech, and provide strategic leadership in securing heart pump technologies,